UBUNTU-CVE-2020-2907

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracl...

CVE-2020-7275 Unquoted service paths for some McAfee ENS files

Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security ENS for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file...

CVE-2020-7278

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

OnePlus 7 Pro Information Disclosure Vulnerability

The OnePlus 7 Pro is a smartphone from China's Wampus Technology OnePlus. A security vulnerability exists in versions prior to OnePlus 7 Pro 10.0.3.GM21BA. The vulnerability can be exploited by an attacker to obtain a fingerprint image bitmap from the fingerprint sensor...

Industrial Light and Magic OpenEXR Input Validation Error Vulnerability

Industrial Light and Magic LIM OpenEXR is an image file format from Industrial Light and Magic LIM, USA, for high dynamic range HDR images. An input validation error vulnerability exists in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock in versions of LIM OpenE...

Industrial Light and Magic OpenEXR Out-of-Bounds Read Vulnerability

Industrial Light and Magic LIM OpenEXR is an image file format from Industrial Light and Magic LIM, USA, for high dynamic range HDR images. An out-of-bounds read vulnerability exists in LIM OpenEXR versions prior to 2.4.1, which can be exploited by an attacker to cause an application to crash or...

CVE-2020-7574

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the "Server Config" web interface of the affected devices that could allow an attacker to inject...

CVE-2020-7801

The Synergy Systems & Solutions SSS HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized Actor CWE-200 vulnerability. The affected product is vulnerable to information exposure over the SNMP protocol. This is a different issue than...

DEBIAN-CVE-2020-6444

Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2020-6433

Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Vastgota-Data ProVide User Web Interface Cross-Site Scripting Vulnerability

Vastgota-Data ProVide is a file transfer server with a graphical user interface from Vastgota-Data, Sweden. A cross-site request forgery vulnerability exists in the user web interface in Vastgota-Data ProVide 13.1 and prior versions. The vulnerability stems from the WEB application not adequately...

IBM Resilient Information Disclosure Vulnerability

IBM Resilient is a suite of incident response platforms from IBM in the United States. The platform supports functions such as incident response process orchestration and incident management. A security vulnerability exists in versions prior to IBM Resilient v35.2, which stems from the program's...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10603

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

netABuse Insufficient Windows Authentication Logic Scanner

import os,re,time,signal,sys from subprocess import from multiprocessing import Process By John Page aka hyp3rlinx Apparition Security twitter.com/hyp3rlinx Advisory: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NET-USE-INSUFFICIENT-PASSWORD-PROMPT.txt...

CVE-2020-1988

An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the root of the OS disk C:\ or to Program Files directory to gain system privileges. This issue affects Palo Alto Networks GlobalProtect Agent 5...

CVE-2020-10633

A non-persistent XSS cross-site scripting vulnerability exists in eWON Flexy and Cosy all firmware versions prior to 14.1s0. An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can ...

Advantech WebAccess/NMS SQL Injection Vulnerability (CNVD-2020-22315)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A SQL injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by attackers to obtain sensitive information...

Advantech WebAccess/NMS Path Traversal Vulnerability (CNVD-2020-22313)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...